[001] Document droplet groundwork: swap, firewall, DNS

README.md

@@ -71,6 +71,78 @@ Bring the proxy up (or recreate it after a compose change) from that directory:
 docker compose up -d
 ```
 
+## Droplet groundwork
+
+Baseline host configuration for the droplet (`wloud`, 174.138.36.232,
+2 GB RAM, 2 vCPUs, 58 GB disk). Everything below was set up once and only
+needs revisiting when the host changes.
+
+### Swap
+
+The droplet has 2 GB RAM and no swap by default; a 2 GB swapfile prevents
+Out Of Memory (OOM) kills during on-droplet builds and daemon memory spikes.
+It is created once with (requires sudo):
+
+```sh
+sudo fallocate -l 2G /swapfile
+sudo chmod 600 /swapfile
+sudo mkswap /swapfile
+sudo swapon /swapfile
+echo '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstab
+echo 'vm.swappiness=10' | sudo tee /etc/sysctl.d/99-swappiness.conf
+sudo sysctl -p /etc/sysctl.d/99-swappiness.conf
+```
+
+The fstab entry makes it survive reboots; swappiness 10 keeps the kernel from
+swapping eagerly. Verify with `free -m` (~2048 total swap) and, after a
+reboot, `swapon --show`.
+
+### Firewall
+
+`ufw` is installed and active on the host. Probing from outside the droplet
+(2026-07-23) showed no filtering in the path for the service ports: 2222/tcp
+and 22000/tcp answered "connection refused" while nothing listened, which
+means packets reach the host, so neither ufw nor a DigitalOcean cloud
+firewall blocks them. Ports in use:
+
+| Port      | Proto   | Service                        |
+|-----------|---------|--------------------------------|
+| 22        | tcp     | host sshd                      |
+| 80, 443   | tcp     | Caddy (all HTTP/HTTPS traffic) |
+| 2222      | tcp     | Forgejo git-over-SSH           |
+| 22000     | tcp+udp | Syncthing sync protocol        |
+
+If ufw rules are ever tightened, keep the four rows above allowed. To
+re-verify reachability from any machine outside the droplet:
+
+```sh
+nc -vz 174.138.36.232 2222
+nc -vz 174.138.36.232 22000
+nc -vzu 174.138.36.232 22000
+```
+
+"Connection refused" means the port is reachable but nothing listens yet;
+only a timeout indicates a filter.
+
+### DNS
+
+All records live on the DigitalOcean nameservers (ns1-3.digitalocean.com)
+and point at the droplet:
+
+| Record             | Type | Value           | Serves               |
+|--------------------|------|-----------------|----------------------|
+| waldson.com.br     | A    | 174.138.36.232  | personal site        |
+| www.waldson.com.br | A    | 174.138.36.232  | redirect to apex     |
+| git.waldson.com.br | A    | 174.138.36.232  | Forgejo              |
+| sync.waldson.com.br| A    | 174.138.36.232  | Syncthing GUI        |
+
+personaledson.com.br and nazareonline.com.br also resolve here for the
+existing stacks. Check resolution with:
+
+```sh
+dig +short waldson.com.br www.waldson.com.br git.waldson.com.br sync.waldson.com.br
+```
+
 ## Notes
 
 - `letsencrypt/acme.json` is leftover state from an earlier Traefik-based proxy